What is the EU and US Privacy Shield

New U.S. Privacy Shield. Brussels and Washington clinched a new transatlantic deal that aims to facilitate exchanges of data between firms in both regions. On Monday, the European Commission issued the legal context of the Privacy Shield. Once adopted, it would urge U.S. firms to comply with new rules that align with EU standards. Before our discussion, let's take a look.

A new transatlantic data transfer deal.

The EU and U.S.

clinched a deal on a new data a data transfer framework that will govern how Europe's user data is sent to America. The previous framework, Safe Harbor, was quashed by a top EU court last year after revelations about US government surveillance caused political backlash in Europe. Under the new agreement, the EU-US Privacy Shield, there will be an annual review to check that the new system is working properly. And the US side will appoint an ombudsman to handle complaints from EU citizens about the Americans spying on their data. European data privacy watchdogs will also work with their U.S. counterpart, the Federal Trade Commission, to address any flagged problems. The announcement of the pact was welcomed by transnational businesses. Technology companies like Google and Facebook especially rely on data transfer to conduct routine business activities. However, after Snowden's leak, public concerns about data privacy have been raised. The current debate between Apple and the FBI has again brought the issue to the fore. The new deal is still waiting for the sign-off of EU members. Will it really protect European users' data privacy in exchanges between the two regions? It's hard to say at the moment.

And for more on this very interesting topic, we are joined in Boston by Mr. Robert Siciliano, who is a security expert. With IT company Hotspot Shield. Meanwhile, in Washington, we are joined by Dr. Ernest McDuffie, the founder and the CEO of the Global McDuffie Group. That is a private consulting firm focused on cybersecurity education. And in Brussels, in Europe, we are joined by Mr. Pierre Klepp. He is the head of the Brussels office of Open Europe. Gentlemen, welcome to the three of you. First of all, Mr. Klepp, many wonder whether this new agreement yet to be adopted by both sides likely to be just cosmetic in terms of protecting real privacy of the end users in Europe.

Well, I think we have to make a distinction between, on the one hand, protecting people from companies and on the other, protecting people from government interference. With regards to protecting them from companies, I think the legal framework for European individuals to challenge big companies has definitely been improved, while of course keeping the obligation for every person that when they sign up to Facebook, they know that according to the general terms, certain things will happen with their privacy. Secondly, when it comes to protecting people in Europe from US Secret Service spying. I think there's also quite a bit of progress in the sense that there's now this ombudsman. There's, for the first time, commitment from the US side to take this concern into account. So I think overall it is a step forward.

Mr. Siciliano, do you agree with that? After all, you are working on Security.

Yeah, I think, um, uh, previous speaker, uh, certainly, um, is optimistic.

Uh-huh.

Uh, I'm not so much. I think a lot of it is, uh, semantics, that, uh, in the end it really revolves around the honor system. And as long as everyone is being honest in their, uh, goal to be transparent, then we'd be fine. But, uh, as time progresses and as more data is transferred amongst, uh, both United States and European companies, uh, governments will want even more access to it. Companies will find other ways to exploit it, and in the end I'm not sure that any of this has any teeth.

Earlier we did listen very clearly to Mr. Klepp talking about privacy, and he mentioned that after all, everybody signs on the deal before they use certain services. And therefore, I want to get your opinion, Mr. Siciliano, because there are many services we need to have in modern days and we do not have much other options. We have to sign up on it because The other choices seem to do not provide much alternatives. So are end users in a situation that they are likely to be exploited anyway by companies and governments and they're in such an inferior position to compete and argue? Mr. Siciliano.

Well, there's two significant motivations here. One, of course, is security, and security is a motivation that keeps governments wanting more access. And then the other motivation, of course, is money, and money often trumps everything. And so there is a certainly a delicate balance between privacy and security, one that we continue to debate. And in the end, honestly, money often ends up winning.

Mm.

Dr. McDuffie, you and I have been talking about Apple's deal vis-à-vis FBI. It is still going on every day. There's new development. What do you make of this specific deal, at least between governments? Europe and the United States. Will they really solve the problem that many are concerned about privacy, about money likely to exploit the rights of citizens?

So there's two factors here. First, the deal in question, the UN— the US— the European-US Privacy Shield deals with companies specifically. So you You know, the individuals are kind of a secondary effect as they interact with the specific companies. And certainly having a transparent bilateral agreement between the U.S. and the EU is a step in the right direction. The fact that they had attempted this already a few years ago with Safe Harbor and found it inadequate and went back to the table and tried to address those issues and now have made it even stronger. I think it's a positive step. You want to have some kind of a relationship in paper on the table so people know what the rules are. So whether it's perfect or not, I don't think any agreement is perfect right out of the box, but definitely a step in the right direction. And the fact that it's going to be reviewed periodically means that there's room for improvement.

There are two things it seems a lot of you have mentioned. For journalists like us, it is also important, these two things. We are being told the stories are about following the money. Many of the stories we cover. And the other clue we should follow is whether governments are trustworthy to begin with. So on that point, I would like to go back to Mr. Klepp for your opinion. You heard from Mr. Siciliano talking about his views. He seemed to be be much more skeptical than you are. What do you make of it? And is this deal really likely? On the one hand, about companies, but on the other hand, eventually it should be about end users, because otherwise these American companies will not even have— would have only limited access to the European markets if things are not going to the right direction.

Well, in terms of protecting people from government abuse, I do think the deal is a step forward, probably not sufficient, but then this is the eternal trade-off between security and privacy. With regards to enabling companies to make money, we should keep in mind that companies will only be able to make money if they actually provide a service. So what really happens is The more you bind the hands of these companies who rely heavily on databases and user information, the less able they are going to be to provide services to customers. Secondly, the more bureaucratic you make it for them, the harder it's going to be for small companies, new companies that want to innovate, that want to challenge the big big players, you know, Facebook, Google, are going to manage to deal with this, but smaller competitors may not be.

Mr. Siciliano, but how should we really look at this deal? Because the reason why more and more American companies, including Apple, some suggest, are more caring about the privacy of their users is because of the Snowden revelation. And consumers are upset, whether in Europe, in the US, or elsewhere, about these tech companies selling, quote unquote, information to the governments as long as the latter wants. So that, of course, is debated in various countries and various— under various different circumstances. But what do you make of the intention of the companies involved in this Can governments monitor companies well?

Well, the, um, companies involved, uh, want to know what they can and can't do. They want specific guidelines that they, uh, should adhere to. They don't want there to be, uh, any questions as to whether they can or can't slurp up certain amounts of data, what they can and can't do with it. They want everything to be specifically defined. And when you see European countries suing American companies in regards to privacy issues based on information that they are grabbing, slurping, it ends up hurting these companies. And so they can alleviate a lot of the litigation by having well-defined rules to follow. So in that regard, in that respect, it's a good thing for these companies so that they can effectively conduct business without continually being up against litigation.

But Mr. McDuffie, if I understand right, the technological innovation and how it's being applied in real life has much— has been going much beyond the legislations and the government agreements. And therefore, on the one hand, you could say tech companies are trying to find very clearly the lines of legal and not legal. But on the other hand, it seems to also give them the leeway of looking for loopholes as technology develops, as application of technologies being spread around very quickly.

So there's a couple of points here. Number one, it's not just about the use of the everyday citizen interface with the companies. There's also the issue of company to company, particularly for multinationals doing business across orders, it's a real hindrance not to have these kind of clear-cut rules in place in order for that business model to be effective. The other point that you make is absolutely true. Technology will always be ahead of legislation, so there's always that kind of gray area as new technology comes online. But the even bigger issue is it's a global issue. It's not just an issue between information between the U.S. and the EU. If companies go to third parties outside of those two, none of these rules would apply at all. So the global supply chain, the kind of agreement— arrangement that we're making between the U.S. and China, the U.S. and the EU, really need to be global deals for them to be effective because there's always other ways around if you just don't deal with the two countries involved directly and go to third parties outside of the agreement.

It is no secret, Mr. Klepp, internationally speaking, there has been an enormous lack of agreements in terms of technology innovation and also information privacy. At the UN, there is a system dealing with that but has failed so far to reach anything. Not only between US and EU, but also many other countries as well, as Mr. McDuffie mentioned. Is this deal likely to be an interesting case study? Is it going to be a worthwhile case study for the others? Mr. Klepp.

Yeah, I think it will be. Of course, you should keep in mind that the European Court of Justice will still most likely rule about this, whether it will be satisfied with the changes that have been made. Now, I think that we need to be careful though not to sort of constrain companies into some kind of a very inflexible international regulatory framework. I mean, the real danger to privacy in the end, at the end of the day, will not be prevented by regulation but will be prevented by technology. For example, encryption technology. And what we see is that the authorities in the United States but also elsewhere, are trying to prevent companies from developing this. There was recently the case with Apple refusing or trying to block US government attempts to intervene into Apple's encryption technology. So I think we definitely need to allow companies to develop that so people can basically protect themselves.

Can we really depend on technology? Can we really depend on the good feelings and the so-called honest attitudes coming from companies, even though they were not honest years ago and now appear to be honest? Well, as long as they're doing good things, it's good for us, for the end users and consumers. But Mr. McDarby, what can we depend on, particularly for individual consumers? They are feeling extreme helplessness.

Yes, so it's really a matter of trust, right? Do you trust the companies you're dealing with? Do you trust the governments that you're living under? And it's the individual user's responsibility to be informed as to what's going on, what the actual current technology is, and what you can do as an individual to make sure that you take advantage of all the technology that's available. For you. It's, it's one of those things that you really can't put in a box. Uh, technology research is advancing around the globe under all kinds of different environments, some that are completely out of the control and the view of any government. And so these technological advances will continue to happen regardless of any type of, uh, regulation, whether it's bilateral or global or, or whatever. So as an individual, you have to You have to remain constant learning, in the learning mode, to stay on top of what's happening with the technology. And, you know, you have to take that responsibility on for yourself.

Wow, Mr. McDuffie, that's quite a high requirement, I have to say, even for technology experts like you. I saw your smile. But let me go to you, Mr. Siciliano. So our consumers, our individuals these days, The certain weaker party, how can they change their fate? Can anyone help? Are they dependable? Your judgment.

Well, in the end, you know, the consumer has the ability to vote. And if they are supporting those who are in favor or not of certain, you know, encryption standards, certain security protocols, privacy trumping security or vice versa, they have a certain say. But in the end, there is no question about it that personal responsibility is fundamental. Understanding what your risks and responsibilities are, it is a double-edged sword. Technology, we love it, but at the same time it can cause all kinds of issues in our personal professional lives. Becoming fully informed, I think, is fundamental. It's absolutely necessary today. The pace of technology is, you know, far exceeding, you know, the laws in place. So it's important that consumers are aware of what their rights and responsibilities are.

Are we going to see a trend eventually, Mr. Klepp, briefly from you, as there's so much attention spotlight on the CICAP on this so-called privacy issue and people's requirement for that is getting ever more urgent. Are we going to see new technologies ever popping up more actively about privacy, how to protect privacy, and even new technology popping up while at the same time how to use this technology and prevent the loss of privacy also would like to emerge at the same time? Is that likely to be the trend for the next stage of technology?

Well, I do think so. I think there's a very big demand among consumers. For example, if you look at the reaction of privacy campaigners towards this EU-US deal, they were very disappointed, although I think it is a small step in the right direction. But I do think that people realize that, you know, they cannot expect everything from the regulator So they sort of will have to rely on themselves. So I think that sort of that feeling will in the end prevail and will increase the demand to ever more technological protection for privacy.

Ever-changing world. Thank you so much, gentlemen, for shedding some light on what we are dealing with, at least for now. Peter Klepp, Ernest MacDuffie, and also Robert Siciliano. Really appreciate it, gentlemen. Thank you so much.

Thanks.